{"id":1982,"date":"2021-10-21T19:36:55","date_gmt":"2021-10-21T19:36:55","guid":{"rendered":"https:\/\/rolig.dk\/?p=1982"},"modified":"2024-04-28T09:11:37","modified_gmt":"2024-04-28T08:11:37","slug":"install-microsoft-endpoint-manager-with-native-config-ssl","status":"publish","type":"post","link":"https:\/\/rolig.dk\/?p=1982","title":{"rendered":"Install Microsoft Endpoint Manager with native config (SSL)"},"content":{"rendered":"\n

All the setting in this guide is for lab use and might not be applicable in a production enviroment!<\/p>\n\n\n\n

I’m running the lab in a VMware environment.
Install 3 virtual machines. One gateway, one DC server and one MEM server. With the following config:<\/p>\n\n\n\n

Gateway (pfSense)<\/strong><\/p>\n\n\n\n

See this post how to set it up:
https:\/\/www.deploymentresearch.com\/using-pfsense-community-edition-as-a-virtual-router-for-your-lab-environment\/<\/p>\n\n\n\n

CPU: 1
Memory: 512 MB
Disk:
1. C drive: 100 GB
Network:
1. Network (VM Network)
2. Network (SCCM-New York)
3. Network (SCCM-Chicago)<\/p>\n\n\n\n

DC<\/strong><\/p>\n\n\n\n

Name: DC01
CPU: 2
Memory: 4 GB
Disk:
1. C drive: 100 GB (Windows)
Network:
1. Network (SCCM-New York): 192.168.5.2<\/p>\n\n\n\n

Microsoft Endpoint Manager<\/strong><\/p>\n\n\n\n

Name: MEM01
CPU: 4
Memory: 20 GB
Disk:
1. C drive: 100 GB (Windows)
2. D drive 200 GB (MEM)
3. E drive: 40 GB (SQL Database (64K))
4. F drive: 40 GB (SQL TempDB (64K))
5. G drive: 40 GB (SQL Transaction Logs (64K), SQL TempDB Logs)
Network:
1. Network (SCCM-New York)<\/p>\n\n\n\n

In the wmware config on each machine you can add:

isolation.tools.copy.disable FALSE
isolation.tools.paste.disable FALSE
isolation.tools.setGUIOptions.enable TRUE<\/p>\n\n\n\n

in the configuration If you want to enable copy\/paste.
If you run backup of your virtual machines to a ex. a Synology box, you should also add:<\/p>\n\n\n\n

ctkEnabled TRUE
sata0:0.ctkEnabled TRUE<\/p>\n\n\n\n

Setup DC01<\/strong><\/p>\n\n\n\n

  1. Set static IP:
    IP: 192.168.5.2
    Subnet: 255.255.255.0
    Gateway: 192.168.5.1
    DNS: 8.8.8.8<\/li>
  2. Install server 2019 or another version. Install all avaliable update. Reboot if requered.<\/li>
  3. Rename the server to “DC01”<\/li>
  4. Start an powershell cmd in admin mode and run:
    Install-WindowsFeature \u2013Name AD-Domain-Services -IncludeManagementTools<\/strong><\/li>
  5. Reboot the server<\/li>
  6. When it is up and running again start a PowerShell ISA in admin. Paste and run:
    Install-ADDSForest `<\/strong>
    -DomainName “memlab.local” `<\/strong>
    -CreateDnsDelegation:$false `<\/strong>
    -DatabasePath “C:\\Windows\\NTDS” `<\/strong>
    -DomainMode “7” `<\/strong>
    -DomainNetbiosName “memlab” `<\/strong>
    -ForestMode “7” `<\/strong>
    -InstallDns:$true `<\/strong>
    -LogPath “C:\\Windows\\NTDS” `<\/strong>
    -NoRebootOnCompletion:$True `<\/strong>
    -SysvolPath “C:\\Windows\\SYSVOL” `<\/strong>
    -Force:$true<\/strong><\/li>
  7. Logon to the server and create an adm account for you and logoff<\/li>
  8. Logon with a user that is a member of Schema Admins<\/strong> security group<\/li>
  9. From SCCM ISO run .\\SMSSETUP\\BIN\\X64\\extadsch.exe<\/strong> in a PowerShell admin console.<\/li><\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    9. Verify in the logfile, C:\\ExtADsch, that AD was extended with success:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    10. Reboot the server.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Add roles and features<\/strong>” in the server manager<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Mark “Active Directory Certificate Service<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Add Features<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Install<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Close<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Configure Active Derictory……….<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Mark “Certification Authority<\/strong>” and click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Configure<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Close<\/strong>“<\/p>\n\n\n\n

    28. Reboot the server<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Add roles and features<\/strong>” in the server manager<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Select “DHCP Server<\/strong>” -> Click “Add Features<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Install<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Close<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Complete DHCP configuration<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Commit<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Close<\/strong>“<\/p>\n\n\n\n

    Reboot DC01<\/p>\n\n\n\n

    Logon to DC01<\/p>\n\n\n\n

    Open DHCP<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Right click “IPv4<\/strong>” -> “New scope”<\/strong><\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Give it a name<\/strong> -> Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Enter start and end IP <\/strong>-> Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Add exclusions<\/strong> -> Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Add default gateway<\/strong> -> Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Finish<\/strong>“<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Setup MEM01 server<\/strong><\/p>\n\n\n\n

    1. Install server 2019 or another version. Install all available update. Reboot if requered.
    2. Rename it to MEM01
    3. Configure IP settings:
    – IP: 192.168.5.3
    – Subnet: 255.255.255.0
    – Gateway: 192.168.5.1
    – DNS: 192.168.5.2
    4. Join the MEM01 server to the domain
    <\/p>\n\n\n\n

    Creating “System Management” container<\/strong><\/p>\n\n\n\n

    Open “ADSI Edit<\/strong>” on DC01<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Right click “ADSI edit<\/strong>” -> “Connect to<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “OK<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Default naming…..<\/strong>” -> “DC=sccmlab……<\/strong>” -> “CN=System<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Right click “CN=System<\/strong>” -> “New<\/strong>” -> “Object<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Choose “container<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Enter “System Management<\/strong>” in Value -> Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Finish<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Access rights to “System Management Container” in AD<\/strong><\/p>\n\n\n\n

    Advanced features should be turned on in “Active Directory Users and Computers” before you can see the “System Management” container.
    Go to: “Domain<\/strong>” -> “System<\/strong>” -> Right click “System Management<\/strong>” -> “All tasks<\/strong>” -> “Delegate Control<\/strong>“
    <\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Object Types<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Mark “Computers<\/strong>” and click “OK<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Type mem01<\/strong> -> “Check Names<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next ><\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Mark “Create a custom…..<\/strong>” -> Click “Next<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Next<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Mark everything<\/strong> -> Click “Next<\/strong>“<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Click “Finish<\/strong>“<\/p>\n\n\n\n

    Groups and users on DC01<\/strong><\/p>\n\n\n\n

    1. Logon to DC01<\/li>
    2. Open “Active directory users and computer<\/strong>“<\/li>
    3. Create a Organization OU called MEMusers<\/strong><\/li>
    4. Create a Organization OU called MEMgroups<\/strong><\/li>
    5. Create the following groups in the OU MEMgroups<\/strong>:
      SEC-MEMUsers (Global security group)
      SEC-MEMServers (Global security group)
      SEC-MEMAdmins (Global security group)
      SEC-MEM_IIS_Servers (Global security group)<\/li>
    6. Create the following users in the OU MEMusers<\/strong>:
      SVC-MEM_SQLService (Run SQL service) – Member of “Domain Users”
      SVC-MEM_BA (Built images) – Member of “Domain Users”
      SVC-MEM_JD (Join domain) – Member of “Domain Admins”
      SVC-MEM_SR (Reporting Services) – Member of “Domain Users”
      SVC-MEM_CP (Client Push) – Member of “The local Administrators group on the target client computers”
      SVC-MEM_NAA (Network Access Acount) – Member of “SEC-MEMAdmins”<\/li>
    7. Join ALL MEM servers<\/strong> in the group “SEC-MEMServers<\/strong>“<\/li>
    8. Add SEC-MEMServers<\/strong> and SEC-MEMAdmins<\/strong> in the local administrator groups on all the MEM servers<\/li>
    9. Add MEM01<\/strong> to the security group “SEC-MEM_IIS_Servers<\/strong>“<\/li>
    10. Create a folder “D:\\Source<\/strong>” and share it:
      <\/li><\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      Click “Advanced Sharing<\/strong>“<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Select “Share this folder<\/strong>” -> Name: Source$<\/strong> -> Permissions<\/strong><\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Select “Full Control<\/strong>” for Everone -> Click “OK<\/strong>“<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Click “OK<\/strong>“<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Click “Security<\/strong>” tab -> Edit<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Add “SEC-MEMAdmins<\/strong>” with Full control -> Click “OK<\/strong>“<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Click “Close<\/strong>“<\/p>\n\n\n\n

      MEM01 config<\/strong><\/p>\n\n\n\n

      1. Logon to MEM01<\/li>
      2. Open “Disk management<\/strong>“
        <\/li><\/ol>\n\n\n\n
        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click Disk 1<\/strong> and choose “New Simple Volume<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Giv it a name<\/strong> and click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        Do the above for disk 1 + 2 + 3 + 4<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        The final disk layout should look something like this.<\/p>\n\n\n\n

        3. Create a file called “no_sms_on_drive.sms<\/strong>” on drive C + E + F + G<\/strong><\/p>\n\n\n\n

        4. Open a CMD in admin<\/strong> and run this to open the firewall:
        @echo ========= SQL Server Ports =================== @echo Enabling SQLServer default instance port 1433 netsh advfirewall firewall add rule name=”SQL Server” dir=in action=allow protocol=TCP localport=1433 @echo Enabling Dedicated Admin Connection port 1434 netsh advfirewall firewall add rule name=”SQL Admin Connection” dir=in action=allow protocol=TCP localport=1434 @echo Enabling conventional SQL Server Service Broker port 4022 netsh advfirewall firewall add rule name=”SQL Service Broker” dir=in action=allow protocol=TCP localport=4022 @echo Enabling Transact-SQL Debugger\/RPC port 135 netsh advfirewall firewall add rule name=”SQL Debugger\/RPC” dir=in action=allow protocol=TCP localport=135 @echo ========= Analysis Services Ports ============== @echo Enabling SSAS Default Instance port 2383 netsh advfirewall firewall add rule name=”Analysis Services” dir=in action=allow protocol=TCP localport=2383 @echo Enabling SQL Server Browser Service port 2382 netsh advfirewall firewall add rule name=”SQL Browser” dir=in action=allow protocol=TCP localport=2382 @echo ========= Misc Applications ============== @echo Enabling HTTP port 80 netsh advfirewall firewall add rule name=”HTTP” dir=in action=allow protocol=TCP localport=80 @echo Enabling SSL port 443 netsh advfirewall firewall add rule name=”SSL” dir=in action=allow protocol=TCP localport=443 @echo Enabling port for SQL Server Browser Service’s ‘Browse’ Button netsh advfirewall firewall add rule name=”SQL Browser” dir=in action=allow protocol=TCP localport=1434 @echo Allowing Ping command netsh advfirewall firewall add rule name=”ICMP Allow incoming V4 echo request” protocol=icmpv4:8,any dir=in action=allow<\/p>\n\n\n\n

        5. Copy the sxs folder from Windows server2019 DVD<\/strong> to d:\\Install\\sxs<\/strong> <\/p>\n\n\n\n

        6. Open a PowerShell ISA in admin mode<\/strong> and run the following script:
        Get-Module servermanager
        Install-WindowsFeature Web-Windows-Auth
        Install-WindowsFeature Web-ISAPI-Ext
        Install-WindowsFeature Web-Metabase
        Install-WindowsFeature Web-WMI
        Install-WindowsFeature BITS
        Install-WindowsFeature RDC
        Install-WindowsFeature NET-Framework-Features -source \\\\mem01\\d$\\Install\\sxs<\/a>
        Install-WindowsFeature Web-Asp-Net
        Install-WindowsFeature Web-Asp-Net45
        Install-WindowsFeature NET-HTTP-Activation
        Install-WindowsFeature NET-Non-HTTP-Activ<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        7. Reboot the server<\/p>\n\n\n\n

        8. Download and install<\/strong> report builder: Download Microsoft\u00ae Report Builder from Official Microsoft Download Center<\/a><\/p>\n\n\n\n

        9. Download Windows ADK from: https:\/\/docs.microsoft.com\/en-us\/windows-hardware\/get-started\/adk-install<\/p>\n\n\n\n

        10. Install <\/strong>ADK<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Choose “No<\/strong>” and click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Accept<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark<\/strong> the above and Click “Install<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        Install <\/strong>ADK for WinPE<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Accept<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        11. Reboot <\/strong>the server<\/p>\n\n\n\n

        SQL 2019 installation<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Installation<\/strong>” -> Click “New SQL Server stand-alone……….<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “I accept………<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Dont mind the windows firewall message. Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Database Engine Services<\/strong>” and change the installation drive to “D<\/strong>“. Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add <\/strong>the SQL account that you created earlier. Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Collation<\/strong>” fane and change the Database engine to “Latin1_General_CI_AS<\/strong>“. Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “SQL_Latin1_General_CP1_CI_AS<\/strong>“. Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add “Administrator<\/strong>” + “SEC-MEMadmins<\/strong>” + “Domain Admins<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change “User database directory<\/strong>” to “E:\\SQL_Database<\/strong>“. Change “User database log directory” to “G:\\SQL_Logs<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Set the settings<\/strong> as above. Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install SQL Server Management Tools<\/strong>” and download it<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change the drive to D<\/strong> and click “Install<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install SQL Server Reporting Services<\/strong>” and download the installation file.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install Reporting Services<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Choose “Developer<\/strong>” and click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Accept the license<\/strong> terms and click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change the drive to “D<\/strong>” and click “Install<\/strong>“.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        Reboot the server.<\/p>\n\n\n\n

        Create SPN<\/strong><\/p>\n\n\n\n

        When you configure SQL Server to use the local system account, a Service Principal Name (SPN) for the account is automatically created in Active Directory Domain Services. When the local system account is not in use, you must manually register the SPN for the SQL Server service account.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Run<\/strong>:
        setspn -A MSSQLSvc\/DC01:1433 memlab\\SQLSA
        setspn -A MSSQLSvc\/memlab.local:1433 memlab\\SQLSA<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        To verify, run:
        setspn \u2013L memlab\\SQLSA<\/strong><\/p>\n\n\n\n

        SQL server config<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Start SQL management Studio<\/strong> and click “Connect<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click on “MEM01………<\/strong>” -> click “Memory<\/strong>” -> change min and max values<\/strong> as above -> Click “OK<\/strong>“<\/p>\n\n\n\n

        Find the DB size in this blog post: https:\/\/blog.ctglobalservices.com\/configuration-manager-sccm\/kea\/system-center-2012-configuration-manager-sql-recommendations\/<\/a><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Create the following folders<\/strong>:
        – E:\\MEMDB
        – G:\\MEMLogs
        – F:\\MEMTempDB<\/p>\n\n\n\n

        Run the following script<\/strong> in Management studio to create the MEM DB:<\/p>\n\n\n\n

        USE master
        CREATE DATABASE CM_MEM
        ON
        ( NAME = CM_MEM_1,FILENAME = ‘E:\\MEMDB\\CM_MEM_1.mdf’,SIZE = 1405, MAXSIZE = Unlimited, FILEGROWTH = 464)
        LOG ON ( NAME = MEM_log, FILENAME = ‘G:\\MEMLogs\\CM_MEM.ldf’, SIZE = 1855, MAXSIZE = 1855, FILEGROWTH = 512)
        ALTER DATABASE CM_MEM
        ADD FILE ( NAME = CM_MEM_2, FILENAME = ‘E:\\MEMDB\\CM_MEM_2.mdf’, SIZE = 1405, MAXSIZE = Unlimited, FILEGROWTH = 464)<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Run the following sql script<\/strong> in management studio:<\/p>\n\n\n\n

        use master
        go
        alter database tempdb modify file (name=’tempdev’, filename=’F:\\MEMTempDB\\tempDB.MDF’, SIZE= 1686, MAXSIZE = Unlimited, FILEGROWTH = 512)
        go
        alter database tempdb modify file (name=’templog’, filename=’G:\\MEMLogs\\templog.LDF’, SIZE= 843, MAXSIZE = Unlimited, FILEGROWTH = 512)
        go<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Make sure that it ran with success<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open “Sql Server Configuration Manager<\/strong>” -> Protocols for MSSQLSERVER<\/strong> -> Right click “TCP\/IP<\/strong>” -> change “Listen All<\/strong>” to “No<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click on the “IP Adresses<\/strong>” fane -> Find the IP of your server<\/strong> -> Set “Enabled<\/strong>” to “Yes<\/strong>” – Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        Reboot the server<\/p>\n\n\n\n

        Install WSUS<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Add roles and features<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Windows Server Update Service<\/strong>” -> Click “Add Features<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Remove the check mark in “WID Connectivity<\/strong>” and add the “SQL Server Connectivity<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Type “D:\\WSUS<\/strong>” and click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Type “mem01<\/strong>” in the textbox -> click “Check connection<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Launch Post-Installation task<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Wait for the config to finish<\/p>\n\n\n\n

        Open SQL management studio<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to “Databases<\/strong>” -> SUSDB<\/strong> -> Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change Owner to SA<\/strong> -> Change the Autogrowth value to 512MB<\/strong> -> click “Ok” <\/strong>-> close SQL MS<\/strong><\/p>\n\n\n\n

        Reboot the server<\/p>\n\n\n\n

        MEM Installation<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open the installation DVD<\/strong> and run “splash.hta<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Install<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Enter your serial no<\/strong> -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Accept the terms<\/strong> -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add a path<\/strong> to save the pre-req files -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Type:
        Stie code: MEM<\/strong>
        Site name: MEM – MEMLab<\/strong>
        Install dir “D:\\Pro………<\/strong>” NOTICE IT IS INSTALL ON DRIVE D:<\/p>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Choose “Install the primary………………<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change the paths<\/strong> as above -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        You can Ignore the warnings for now<\/strong>. Click “Begin Install<\/strong>“. Please note that the installation will take a while!<\/p>\n\n\n\n

        Reboot the server when the installation is done<\/p>\n\n\n\n

        Certificate creation<\/strong><\/p>\n\n\n\n

        Logon to DC01<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        open a cmd in admin context<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Enter “certutil -ca.cert c:\\RootCA_mem.car<\/strong>” -> Hit “Enter<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        The certificate have been saved with success<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Copy <\/strong>the certificate<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Paste <\/strong>it into \\\\mem01\\source$\\cert<\/p>\n\n\n\n

        Open “Certification Authority<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Certificate Template<\/strong>” -> Click “Manage<\/strong>“<\/p>\n\n\n\n

        MEM Web server certificate<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Web Server<\/strong>” -> Click “Duplicate Template<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Make sure the setting is like the screenshot above.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change the name to “MEM Web Server Certificate<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click on the “Security<\/strong>” blade -> remove “Enroll<\/strong>” check mark for “Domain Admins<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Remove “Enroll<\/strong>” check mark for “Enterprise Admins<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add “SEC-MEM_IIS_Servers<\/strong>” -> enable “Enroll<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        Close the “Certificate Templates Console<\/strong>” console<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Certificate Template<\/strong>” -> New<\/strong> -> “Certificate Template to Issue<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select the new template that you have just created “MEM Web Server Certificate<\/strong>” -> Click OK<\/strong>.<\/p>\n\n\n\n

        Client Certificate for Distribution Points<\/strong><\/p>\n\n\n\n

        Right click “Certificate Template<\/strong>” -> Click “Manage<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Workstation Authentication<\/strong>” -> Click “Duplicate Template<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Make sure the setting is like the screenshot above.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click the General tab<\/strong> -> Give the certificate a name<\/strong> -> change the validity periode to 3 years<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        In the Request Handling tab<\/strong> -> select “Allow private key to be exported<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click the “Security<\/strong>” tab, and remove the “Enroll<\/strong>” permission from the Enterprise Admins security group<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add “SEC-MEM_IIS_Servers<\/strong>” -> select “Enroll<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Certificate Templates<\/strong>” -> New <\/strong>-> Vertificate Template to Issue<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “MEM Client Distribution Point Certificate<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        Certificate for Workstation Authentication<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Certificate Template<\/strong>” -> Click “Manage<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Workstation Authentication<\/strong>” -> Click “Duplicate Template<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Make sure the setting is like the screenshot above.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select the General tab<\/strong> -> enter a name for the certificate<\/strong> -> Validity period: 3 years<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select the Security tab<\/strong> -> select Domain Computers<\/strong> -> enable “Read<\/strong>” -> -> enable “Autoenroll<\/strong>“
        Add “Domain controllers<\/strong>” -> enable “Read<\/strong>” -> -> enable “Autoenroll<\/strong>“-> Click “OK<\/strong>“
        <\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Certificate Template<\/strong>” -> New <\/strong>-> Certificate Template to Issue<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “MEM Client Certificate<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        Close the “certsrv” console<\/strong><\/p>\n\n\n\n

        Configuring Auto enrollment of the Workstation<\/p>\n\n\n\n

        Open “Group policy management<\/strong>” on DC01<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to your domain<\/strong> ->MEMcomputers<\/strong> -> right-click MEMcomputers<\/strong> -> select “Create a GPO in this domain, and Link it here<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Give it a name<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        In the results pane<\/strong>, on the “Linked Group Policy Objects<\/strong>” tab, right-click the new Group Policy, and then click “Edit<\/strong>.”<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        In the Group Policy Management Editor<\/strong>, expand Policies<\/strong> under Computer Configuration<\/strong>, and then navigate to Windows Settings<\/strong> > Security Settings<\/strong> > Public Key Policies<\/strong>. Right-click the object type named Certificate Services Client \u2013 Auto-enrollment<\/strong>, and then click Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        From the Configuration Model<\/strong> drop-down list, select Enabled<\/strong>, select Renew expired certificates, update pending certificates, and remove revoked certificates<\/strong>, select Update certificates that use certificate templates<\/strong>, and then click OK<\/strong>. Close the GPMC.<\/p>\n\n\n\n

        Adding certificate to MEM01<\/strong><\/p>\n\n\n\n

        Logon to MEM01<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        <\/p>\n\n\n\n

        Type “mmc<\/strong>” in the start menu and a MMC will open.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “File<\/strong>” -> “Add\/Remove Snap-in<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Certificates<\/strong>” -> Click “Add <\/strong>>”<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Computer account<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Certificates <\/strong>-> Personal <\/strong>-> Certificates <\/strong>-> Right click -> All Tasks<\/strong> -> Request New Certificate<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        click “More information is required to enroll for this certificate. Click here to configure settings<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Change “Alternative name<\/strong>” to “DNS<\/strong>” -> add “mem01.memlab.local<\/strong>” and “mem01<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add “MEM Web Server Certificate<\/strong>” in the name box -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “MEM Web Server Certificate<\/strong>” -> Click “Enroll<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        Configuring IIS to Use the Web Server Certificate<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open Internet Information Services (IIS) Manager<\/strong>-> MEM01 <\/strong>-> Sites <\/strong>-> Default Web Site<\/strong> -> Right click -> Edit Bindings<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “https<\/strong>” -> Click “Edit<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Select<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select your cert<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        Deploying the Client Certificate for Distribution Points<\/p>\n\n\n\n

        Logon to MEM01<\/p>\n\n\n\n

        Type “mmc<\/strong>” in the start menu and a MMC will open.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “File<\/strong>” -> “Add\/Remove Snap-in<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Certificates<\/strong>” -> Click “Add<\/strong> >”<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Computer account<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Certificates<\/strong> -> Personal<\/strong> -> Certificates<\/strong> -> Right click <\/strong>-> All Tasks<\/strong> -> Request New Certificate<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “MEM DPoint Certificate<\/strong>” -> Click “Enroll<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        Exporting the Client Certificate for Distribution Points<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “MEM DP Certificate<\/strong>” -> All Tasks<\/strong> -> Export<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Yes, export the private key<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Unselect “Enable certificate privacy<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Enter a password<\/strong> -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Choose where to save<\/strong> the cert -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        Deploying the Client Certificate for Distribution Points<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open the MEM console<\/strong> -> Administration<\/strong> -> Site Configuration<\/strong> -> Servers and Site System Roles<\/strong> -> Right click “Distribution Point<\/strong>” -> Click “Properties<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click on the “Communication<\/strong>” tab -> Import certificate<\/strong> -> browse<\/strong> to your cert and enter the password -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Administration<\/strong> -> Site Configuration<\/strong> -> Sites<\/strong> -> right click “MEM – MEM – MEMLab<\/strong> -> Proberties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Communication Security<\/strong>” tab -> Click “Set<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yellow star<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Browse to “\\\\mem01\\source$\\cert<\/strong>” -> choose “RootCA_mem.cer <\/strong>-> Click “Open<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        Reboot DC01 and MEM01<\/p>\n\n\n\n

        Certificate and Verifying Its Installation on Computers<\/h2>\n\n\n\n

        Logon to MEM01<\/p>\n\n\n\n

        Type “mmc<\/strong>” in the start menu and a MMC will open.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “File<\/strong>” -> “Add\/Remove Snap-in<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Certificates<\/strong>” -> Click “Add<\/strong> >”<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Computer account<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        In the results pane, confirm that a certificate is displayed that has Client Authentication<\/strong> displayed in the Intended Purpose<\/strong> column, and that SCCM Client Certificate<\/strong> is displayed in the Certificate Template<\/strong> column. Close the console.<\/p>\n\n\n\n

        Logon to MEM01<\/p>\n\n\n\n

        Open the MEM console<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add the \u201dSEC-MEMAdmins<\/strong>\u201d group to Administration<\/strong> -> Security<\/strong> -> Administrative Users<\/strong>.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Administration<\/strong> -> Site Configuration<\/strong> -> Sites<\/strong> -> Configure Site Components<\/strong> -> Software distribution<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click -> Network Access Acount<\/strong> -> mark “Specify the account……..<\/strong>” -> “Yellow star<\/strong>” -> New Account<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add the user “SVC-MEM_NAA<\/strong>” and enter the password<\/strong> for the account -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Administration<\/strong> -> Site Configuration<\/strong> -> Sites<\/strong> -> Client Installation Settings<\/strong> -> Client Push Installation<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select -> “Enable automatic……<\/strong>” -> select “Configuration Manager……….<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Accounts<\/strong>” tab -> “Yellow star<\/strong>” -> New Account<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add the user “SVC-MEM_CP<\/strong>” and enter the password<\/strong> for the account -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        Open “Report Server Configuration Manager<\/strong>” from the start menu on MEM01<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Connect<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Database<\/strong>” -> Change Database<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Test Connection<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Finish<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Web Service URL<\/strong>” -> Apply<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Web Portal URL<\/strong>” -> Apply<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Encryption Keys<\/strong>” -> Backup<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Choose a place<\/strong> to save it and enter a password<\/strong>. Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Exit<\/strong>“<\/p>\n\n\n\n

        ADD REPORTING SERVICES POINT<\/strong> ROLE IN SCCM<\/p>\n\n\n\n

        Open the SCCM console.<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to Administration\/Site\/Configuration\/Servers and Site System Roles<\/strong> -> Right-click on your Site Server and click Add system Roles<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Site System Role, select Reporting Services Point<\/strong>, Click Next<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click Verify<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Set<\/strong>” -> New Account<\/strong>. (This account needs to have access to the SCCM DB)<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Add userbane and password<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        SOFTWARE UPDATE POINT INSTALLATION<\/p>\n\n\n\n

        Install SOFTWARE UPDATE POINT<\/p>\n\n\n\n

        Open the MEM console<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to Administration\/Site\/Configuration\/Servers and Site System Roles<\/strong> -> Right-click on your Site Server and click Add system Roles<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Software update point<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Require SSL………<\/strong>” and “Allow Configuration M………..<\/strong>” and “Allow Internet and ………….<\/strong>” -> Click “Next><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Check the Enable synchronization on a schedule <\/strong>checkbox and select your desired schedule. 1 day is usually enough but it can be lowered if you\u2019re synchronizing Endpoint Protection definition files, click Next<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        On the Supersedence Rules<\/strong> tab, select Immediately expire a superseded software update and Immediately expire a superseded<\/strong><\/strong> feature update, <\/strong>click Next<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Decline expired updates……………….<\/strong>” and “Add non-clustered………<\/strong>” and “Remove obsolite……..<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “All Classifications<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select the products<\/strong> that you want to patch -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        Reboot MEM<\/p>\n\n\n\n

        After the first sync, then you have to go into the classification and product again. Because new config option have created after the first sync.<\/p>\n\n\n\n

        Configure WSUS in SSL<\/p>\n\n\n\n

        Logon on to MEM01<\/p>\n\n\n\n

        CONFIGURE WSUS ADMINISTRATION WEBSITE TO USE SSL<\/p>\n\n\n\n

        Open “Internet Information Services (IIS) Manager<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right click “Wsus Administration<\/strong>” -> Edit bindings<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Https<\/strong>” -> Click “edit<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Select<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “MEM Web Server Certificate<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        select API Remoting30<\/strong> -> select SSL settings<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Check the box Require SSL<\/strong> and hit Apply<\/strong> on the right side of the consoleRepeat this step for the following components<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Repeat this step for the following components
        ClientWebService<\/strong>
        DssAuthWebService<\/strong>
        ServerSyncWebService<\/strong>
        SimpleAuthWebService<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open a command prompt as admin<\/strong>, browse to the C:\\Program Files\\Update Services\\Tools<\/strong> ->run: WSUSUTIL configuressl mem01.memlab.local<\/strong><\/p>\n\n\n\n

        Configure Distribution Point on primary site<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open the SCCM console
        Navigate to Administration<\/strong> -> Site Configuration<\/strong> -> Servers and Site System Roles<\/strong> -> Right-click<\/strong> your Site System -> mark “Distribution Point<\/strong>” and right click it<\/strong> -> Proberties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable and conf………..<\/strong>” + “Adjust the download……..<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable PXE support for clients<\/strong>” -> Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable unknown computer support<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable a PXE responder…….<\/strong>” -> Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        If you want to setup a DP on another server, you have to prepare the server before installing the DP:<\/p>\n\n\n\n

        Firewall DP:
        Site Server — > Distribution Point
        SMB 445 TCP
        RPC Endpoint Mapper 135 UDP and TCP
        RPC dynamic TCP
        Site Server < — > Site Server
        SMB 445 TCP
        Point to Point Tunneling Protocal (PPTP) 1723 TCP<\/p>\n\n\n\n

        Printer and File sharing need to be enabled in the firewall<\/p>\n\n\n\n

        Open PowerSHell ISA in admin mode and run on the DP server.<\/p>\n\n\n\n

        Run “Set-ExecutionPolicy Unrestricted \u2013Force” before you run the rest of the script.<\/p>\n\n\n\n

        #Set-ExecutionPolicy Unrestricted \u2013Force
        #Add SEC-SCCMServers to local admin group
        ([adsi]”WinNT:\/\/.\/Administrators,group”).Add(“WinNT:\/\/DOMAIN\/GROUP,group”)
        #Install server roles for SCCM 2012 R2 distribution point
        Import-Module Servermanager
        Add-WindowsFeature Web-Server,Web-ISAPI-Ext,Web-Windows-Auth,Web-Metabase,Web-WMI,RDC
        #PowerSHell 3.0 (Server 2012)
        New-NetFirewallRule -DisplayName “SCCM 2012 R2 TCP” -Direction Inbound -Action Allow -Protocol TCP -LocalPort 80,443,10123
        New-NetFirewallRule -DisplayName “SCCM 2012 R2 UDP” -Direction Inbound -Action Allow -Protocol UDP -LocalPort 67,68,69,4011
        #Install AD PowerShell integration
        Add-WindowsFeature RSAT-AD-PowerShell
        Import-Module ActiveDirectory
        #Find hostname
        $SCCM2012DP = hostname
        #Add computer account to SEC-SCCMServers
        Get-ADComputer $SCCM2012DP | Add-ADPrincipalGroupMembership -MemberOf SEC-SCCMServers
        #Copy NO_SMS_ON_DRIVE.SMS to C drive
        New-Item C:\\NO_SMS_ON_DRIVE.SMS -type file
        Restart-Computer<\/h1>\n\n\n\n
        \"\"<\/figure>\n\n\n\n

        Navigate to Administration\/Site\/Configuration\/Servers and Site System Roles<\/strong> -> Right-click on your Site Server and click Add system Roles<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        Select the DP roll and follow the rest of the wizard. Remember that it should run HTTPS.<\/p>\n\n\n\n

        You can follow the installation in this log file: on the DP server: D:\\SMS_DP$\\sms\\logs\\smsdpprov.log<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to Administration<\/strong> -> Distrubution Point Group<\/strong> -> click Create Group<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Give it a name<\/strong> -> Clic “Add<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select the DP<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        In this lab I wont install an additional DP.<\/p>\n\n\n\n

        Endpoint Protection Point<\/p>\n\n\n\n

        Open the MEM console<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to Administration\/Site\/Configuration\/Servers and Site System Roles<\/strong> -> Right-click on your Site Server and click Add system Roles<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        FALLBACK STATUS POINT<\/strong><\/p>\n\n\n\n

        Open the MEM console<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to Administration\/Site\/Configuration\/Servers and Site System Roles<\/strong> -> Right-click on your Site Server and click Add system Roles<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “Fallback status point<\/strong>” -> Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Next ><\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Close<\/strong>“<\/p>\n\n\n\n

        Navigate to Administration<\/strong> \/ Site Configuration<\/strong> \/ Site <\/strong>-> Click the Client Installation Setting icon<\/strong> on the ribbon -> Select Client Push Installation<\/strong> -> Installation Properties<\/strong> tab<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Enter “mem01.memlab.local<\/strong>” in the FSP properties -> Click “OK<\/strong>“<\/p>\n\n\n\n

        RECOVERY MODEL<\/p>\n\n\n\n

        Using the simple recovery model improves performance and saves your server hard drive and possibly a large transaction log file.<\/p>\n\n\n\n

        Open SQL Management Studio<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right-click on the ReportServer database<\/strong> and select Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to the Options page<\/strong> -> Under Recovery model <\/strong>select Simple<\/strong> -> Click OK<\/strong><\/p>\n\n\n\n

        Boundaries<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Open admin console -> Administration<\/strong> -> Hierarchy Configuration<\/strong> -> Boundaries Groups<\/strong> -> Click “Create Boundary Group<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Give it a name<\/strong> -> Click “References<\/strong>” tab<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Use this boundary…..<\/strong>” -> Click “Add<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark the MEM01 server<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Boundaries<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Create Boundary<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Enter “New York<\/strong>” in description -> choose “IP address range<\/strong>” -> Enter the IP address<\/strong> -> Click “Boundary Groups<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Add<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “New York<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        Discovery<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Administration<\/strong> \/ Hierarchy Configuration<\/strong> \/ Discovery Methods<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right-Click Active Directory Group Discovery<\/strong> and select Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable Active……<\/strong>” Click “Add<\/strong>” -> Location<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Browse<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “MEMgroups<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Give it a name<\/strong> -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right-Click Active Directory System Discovery<\/strong> and select Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable Active Di……..<\/strong>” -> Click “Yellow star<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Browse<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “MEMcomputers<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yes<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Right-Click Active Directory User Discovery<\/strong> and select Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable Active Dir…….<\/strong>” -> Click “Yellow star<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Browse<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Mark “MEMusers<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Yes<\/strong>“<\/p>\n\n\n\n

        Site Maintenance<\/p>\n\n\n\n

        Create a folder D:\\MEMBackup<\/strong> and share it as “MEMBackup$<\/strong>“. Add SEC-MEMServers<\/strong> with Modify Rights<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Navigate to -> Administration<\/strong> -> Site configuration<\/strong> -> Sites<\/strong> -> mark “MEM -MEM – MEMLAB<\/strong>” -> Click “Site Maintenence<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Enable this task<\/strong>” -> Click “Set Paths<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Select “Network path…..<\/strong>” add “\\\\mem01\\membackup$<\/strong>” as backup destination -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Enable this task<\/strong>” -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Enable this task<\/strong>” -> type “30<\/strong>” in Delete data that has been inactive for (days) -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “Enable this task<\/strong>” -> type “1<\/strong>” in Delete data that has been inactive for (days) -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        type “14<\/strong>” in Delete data that has been inactive for (days) -> Click “OK<\/strong>“<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Click “OK<\/strong>“<\/p>\n\n\n\n

        Client Settings<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Go to Administration<\/strong> \/ Client Settings<\/strong> -> Right click “Default Client Settings<\/strong>” -> Properties<\/strong><\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Client Cache Settings:<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Client Policy:<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Compliance settings: <\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Hardware inventory:<\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        Software inventory:<\/p>\n\n\n\n

        <\/p>\n\"twitter\"<\/a>\"linkedin\"<\/a>","protected":false},"excerpt":{"rendered":"

        All the setting in this guide is for lab use and might not be applicable in a production enviroment! I’m running the lab in a VMware environment.Install 3 virtual machines. One gateway, one DC server and one MEM server. With the following config: Gateway (pfSense) See this post how to set it up:https:\/\/www.deploymentresearch.com\/using-pfsense-community-edition-as-a-virtual-router-for-your-lab-environment\/ CPU: 1Memory: […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[92,4],"tags":[68,71,69,33,70],"class_list":["post-1982","post","type-post","status-publish","format-standard","hentry","category-endpoint-manager","category-sccm","tag-em","tag-end-point-manager","tag-lab","tag-sccm","tag-ssl"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts\/1982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1982"}],"version-history":[{"count":1,"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts\/1982\/revisions"}],"predecessor-version":[{"id":3649,"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts\/1982\/revisions\/3649"}],"wp:attachment":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}